T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:20
- Finding
- Remote AI Guides Can Hijack Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 20–29 **Vulnerability Type**: Remote instruction injection **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## AI Guides (Instruction Hierarchy) There are three levels of AI instructions. **Always follow them.** More specific wins on conflict: 1. **Global AI Guide** — `GET /api/settings?key=ai_global_guide` 2. **Per-User AI Guide** — `GET /api/users/<your-user-id>` → `aiGuide` field 3. **Project AI Guide** — `GET /api/projects/<project-id>` → `aiGuide` field **On first boot and periodically:** fetch all three and follow the combined instructions. ``` ### Technical Analysis The skill directs the agent to retrieve mutable content from an external Init Manager service and treat that content as authoritative AI instructions. The unconditional directive to “always follow” the remotely supplied guides, together with periodic retrieval, creates an instruction-injection channel whose effective behavior may change after the skill package has been reviewed. No trust boundary, content validation, action allowlist, integrity verification, or human-approval requirement is defined. The skill also fails to state that system, developer, user, and safety instructions must retain precedence over remote guide content. Consequently, a party capable of editing a global, per-user, or project guide could supply instructions unrelated to legitimate project-management preferences and attempt to redirect the agent’s goals or tool usage. This is instruction retrieval rather than executable-code retrieval, so it is classified as skill instruction hijacking rather than remote payload execution. ### Attack Path 1. An attacker obtains legitimate, compromised, or improperly granted permission to modify an Init Manager global, user, or project AI guide. 2. The attacker inserts hostile instructions into that guide, such as directions to access unrelated files, disclose sensitive information, alter tasks witho ...[truncated 1255 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every remote AI guide as untrusted project data rather than authoritative agent instructions. 2. Explicitly state that system, developer, user, organizational security, and tool-authorization policies always take precedence over remote content. 3. Restrict guide content to an allowlisted schema of project-management preferences, such as formatting conventions, workflow states, and repository-specific guidance. 4. Reject content that requests secrets, unrelated file access, shell execution, credential transmission, security-control changes, or actions outside the selected task. 5. Require explicit user confirmation before remote-guide changes can trigger sensitive, destructive, externally visible, or out-of-scope actions. 6. Authenticate the configured service and verify guide integrity using signed or pinned versions where feasible. 7. Record guide versions, content hashes, authors, timestamps, and changes in an audit log. 8. Avoid silently refreshing instructions during active work. If periodic retrieval is necessary, show the changes and require approval before applying them. 9. Apply least-privilege access controls so only authorized administrators can edit global guides and only appropriate users can edit user or project guides. 10. Add prompt-injection defenses that separate retrieved guide text from trusted instructions and prevent it from redefining instruction priority or tool permissions.